8 ms·

F-Droid: how it weakens Android's security model

40 points by ysnp 5y ago

Friday_ 5y ago
"There's no such thing as a system being secure, only being secure against a particular adversary."
- jmnicolas 5y ago
  My adversary is Big tech trying to control what I see, buy, experience, even think. I started to Tweet about a week ago. Most of my tweets get no traction, but if I speak about Ukraine suddenly I get a lot of views. To me it's the proof that Tweeter is controlling what we're thinking about.
  - ChrisClark 5y ago
    Yeah, it's not like there is any major news about the Ukraine right now that millions of people are searching for. ;)
    - jmnicolas 5y ago
      Are they searching for it or Tweeter is force feeding it to them?
      - southerntofu 5y ago
        For sure more people (and bots) are searching for it. It's also quite possible some people following you (or the people who retweet you) are more interested about this hot topic: you could probably write a dozen tweet about monads and not get any interest, then post a single tweet about Julian Assange or Kim Kardashian and suddenly feel like the entire planet is talking to you. It's quite possible the Twitter algorithms are being nasty (i'm personally strongly against AI deciding what to show and how to order it in a timeline), but it's definitely not the only factor at play.
_joel 5y ago
Given the amount of malware in the play store, I'm not sure about this...
- GuB-42 5y ago
  It is addressed in the article. The point is that F-Droid weakens Android's security model, in other words, F-Droid requires more trust on your part. I think it is reasonable to trust the somewhat niche open source community more than the most popular and therefore the most attacked app store. You may also not want to feed Google, but it doesn't change the fact that F-Droid is technically less secure. The article's debatable suggestion is to get your favorite open source apps you trust from the Play Store to get the best of both worlds. The article is interesting because most of the points are actually fixable by F-Droid. So it is good to see from a "how to improve F-Droid" angle than "F-Droid sucks".
  - onli 5y ago
    But it's irrelevant trust. Stuff about signatures and specific practices. What makes F-Droid more secure are the kind of apps that are in it, that the apps are FOSS alone makes it less likely for spyware to be added to them. Sure it can still happen and then F-Droid's security practices become relevant. But each time you install an app, there is more trust you can give to an app in F-Droid, than the basically zero trust you can give to proprietary app in the play store. The article is completely baffling in not really covering that. "strong security and privacy guarantees" mean jack shit when the game from the play store starts leaking all data it can grab or adds bank phishing - and it will have a bunch of permissions anyway, it legitimately needs them to function.
lucb1e 5y ago
> [devs] have to maintain a slightly different version of their codebase that should comply with F-Droid’s requirements Perhaps that's because I've got half a foot in the foss community and you don't hear a lot of "fml why is f-droid so strict about not using secret code", but to me it seems much more often that people complain about Google's policies than about F-Droid's. Especially since F-Droid's > “quality control” offers close to no guarantees because there are no restrictions on things that just work with root, donation links for open source open geo data contribution platforms[1], roll your own payment scheme without giving anyone a cut, put ads in it if you like... ... and yet I have no qualms letting my grandma browse around f-droid but am terrified of what bank phish she might be shown in an ad after roaming the google store. Technically the author is correct here, of course, but in practice this turns out to be a total non-issue. The rules are also not set in stone if it were to become one suddenly. --- (edited to add) > Their client also lacks TLS certificate pinning As does every web browser, but somehow banking on websites seems to very rarely be intercepted? I don't get the fuss about this and I work in the security industry. We recommend the most secure solutions, but sometimes there are trade-offs here: - Historically it has been recommended to turn off autocomplete in browsers <input> fields. I think we all agree on that one. - Historically it has been recommended to turn off backups in Android because, gee, someone could make a backup of your app data and what if that's an attacker somehow! An auth token might get out! Nobody cares that this makes it physically impossible to backup your data at all anymore on Android (Apple is doing very well on that front, I am very much impressed there even if it's not enough to make me buy into Apple by a long shot). This is one of the reasons I root my device and make fairly extensive use of it. - These days it's being recommended to use cert pinning which is a huge pain in the arms for anyone wanting to toy around with what the app does. Now in this case it's open source anyway, but think of, uh, yeah how about what the article mentions: "unlike Play Store which does that for all connections to Google". Wouldn't it be nice if you could actually see what this app sends to Google about you? Previously you'd add a cert to your OS and you'd be good to go. Now you have to modify the compiled application: a steep learning curve for anyone not working with app pentesting on a regular basis. For a high-security app like your banking app, alright, but for most other things I (as a tech nerd, clearly, I'm not an average user) think it's more harmful than beneficial. > their website has (for some reason) always been hosting an outdated APK of F-Droid, and this is still the case today Part of this sentence is a link to the forum. If you actually click that link, the "for some reason" becomes perfectly clear: f-droid-the-apk releases are shipped whenever it is ready, there is no beta channel in that sense. Whatever is on the homepage should work for everyone with any setup, and from there you can try to upgrade. If that fails, no biggie, you can just use the older version that works. Is what the forum says. (Not that I ever had a broken f-droid version myself, so not sure how important this really is.) > F-Droid is not the only way to get and support open-source apps. [...] Most of the time, releases are available on GitHub, which is great since each GitHub releases page has an Atom feed. Hah, the author just spent ~2800 words criticizing the liberal inclusion policy, missing api target enforcement, outdated (now slightly misleading) permission listings, lagging signature scheme update, and then concludes with "just download the apk from github because it has an Atom feed"! If only f-droid knew that this was the requirement for an endorsement by OP :D (jk) No really, use f-droid instead of github please or make sure you know how to check pgp signatures and have a chain of trust to the developer somehow. Or trust microsoft/github blindly, that's okay too (many of your apps come from there indirectly anyhow, if I'm being fair). But as blanket advice for a source of apps? That's... interesting in this context. > > Should I really care? > If security (and privacy, as they overlap) matters to you [then yes] It depends.... how much does security matter to you? Is this to the exclusion of all other values? It's a bit black-and-white. But then, yeah, as others said, the author works on their own security-oriented Android flavor (which is very good work by the way!). [1] see "un-features" https://github.com/streetcomplete/StreetComplete/releases/tag/v40.1 https://github.com/streetcomplete/StreetComplete/releases/ta... Edit: was this marked as off-topic or why is it stuck to the bottom despite upvotes? Usually neutral comments float somewhere around 2/3rds of the page, this comment is not neutral but upvoted and is at rock bottom.
dTal 5y ago
>The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You’re now adding another party you’ll have to trust since you still have to trust the developer anyway This is fallacious for several reason. Firstly, no I do not "have to trust the developer anyway" - I can always not install the app. I'm not starting with an app, adding my trust of the developer, and adding my trust of F-Droid - I am starting with F-Droid, and only installing apps which F-Droid trusts, because F-Droid's criteria for accepting apps are far more stringent than Google Play's - more stringent even than I could feasibly audit myself. Secondly, trust is not binary. Maybe I trust the developer enough to run their published source code, but not quite enough to run their precompiled binary that they might have slipped some tracking library into. Indeed this is very common and F-Droid strips a lot of such libraries. So even if we take it as a given that I am definitely going to install an app, and my only choice is between installing it from Google Play or from F-Droid, F-Droid is still superior because the builds on F-Droid are built from public source, and I am much more sure that F-Droid themselves won't slip malware into the builds because they have a track record of not doing that. Thirdly, Android's default app store, Google Play, also trusts a third party by default - Google, who insist on running a tracking rootkit on your computer, which is so much more egregiously invasive than trusting any one app that it renders any comparison with F-Droid moot.
- hlbjhblbljib 5y ago
  Doesn't google do exactly the same thing with the app store anyway?
  - david_allison 5y ago
    As of August 2021, new apps must use Android App Bundles. Older apps can still be distributed without providing the key to Google. [0] https://developer.android.com/guide/app-bundle https://developer.android.com/guide/app-bundle [1] https://developer.android.com/guide/app-bundle/faq#app-signing https://developer.android.com/guide/app-bundle/faq#app-signi...
  - orthecreedence 5y ago
    Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great lengths to force distribution through their "safe" channels.
prophesi 5y ago
Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.
- LukeShu 5y ago
  I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.
  - prophesi 5y ago
    After reading the article, I clicked the link to their Github and saw a @GrapheneOS tab in their contribution graph. But taking a second look, I see that they haven't contributed to any of their repos in quite some time.
    - LukeShu 5y ago
      Note that just filing an issue shows up on the contribution graph. Looking a little closer, AFAICT, they have only filed 2 GrapheneOS PRs ever: https://github.com/GrapheneOS/platform_packages_apps_Settings/pull/49 https://github.com/GrapheneOS/platform_packages_apps_Setting... and https://github.com/GrapheneOS/platform_packages_apps_SetupWizard/pull/9 https://github.com/GrapheneOS/platform_packages_apps_SetupWi...
- deleted 5y ago
  [deleted]
- guilhas 5y ago
  I was already under the impression that the GrapheneOS developer(s) were overworked, but still they insist in doing everything themselves because no other project is good enough I have been using for the past year, and the 'advanced' user experience is not great. Updates are forced to the latest version of android, does not seem safe, and definitely does not feel stable, less customization than other roms, a bit aggressive towards root I will probably go back to lineageos microg f-droid and some hardened configurations F-Droid is provides invaluable service for android, privacy, open-source, android developers. GrapheneOS seems like an exercise in craziness a bit to extreme for me
616c 5y ago
This is some lazy "threat modeling without a threat model" kind of stuff IMHO.
- flexagoon 5y ago
  The article is just a list of insecurities of F-Droid. In fact, it even mentions that you can still use F-Droid if it fits your threat model or for ideological reasons.
hlbjhblbljib 5y ago
> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.
- lucb1e 5y ago
  If you trust Microsoft/GitHub more than F-Droid, you could also grab it from there: https://github.com/termux/termux-app#github https://github.com/termux/termux-app#github (you'll have to take care of your own update mechanism though) Not that I'd recommend it personally, but f-droid isn't the only option. Kind of the beauty of open source :). So often apps (e.g. from the government for corona) are only available if you first agree to the Google TOS and privacy policy. Which, of course, most people already did anyway, but the point here is that you don't need to if there's just a build from the devs somewhere, or a build environment you can replicate without too much trouble.
- selfhoster11 5y ago
  Yup. Raising the target SDK means that more phones become ewaste, not because of their hardware becoming outdated, but because their software will never receive an update.
  - rahimnathwani 5y ago
    Raising the minimum SDK level might do this. This is separate from the target SDK level.
    - kuschku 5y ago
      Raising the target SDK just turns a general computing device into a glorified webbrowser, because you lose access to the filesystem, the ability to run background daemons, and the ability to run compilers. These should be permissions, not disabled wholesale.
      - 5y ago
johnx5c 5y ago
F-Droid demands more trust but it is also infinitely more trustworthy than the Play store. It looks like things can be improved (a lot) and I hope it does. F-Droid provides an invaluable service to those who value privacy and open source with very few volunteers.
- BeefWellington 5y ago
  As others have pointed out, this isn't even true anymore. Google's Play Store model lines up with what F-Droid is doing (effectively), so it doesn't really demand more trust, just different trust.
kuschku 5y ago
Yes, you have to trust F-Droid to sign apps. But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymore, Google holds the keys instead. The security model already assumes a third party is signing the apps.
- chasil 5y ago
  What surprises me about this article is that not one word is spoken of other appstores. A lot of bragging takes place about Play, but is silent on Amazon's appstore or any of the Chinese alternatives.
  - Wonderfall 5y ago
    Author here. You're wrong, as I spent several paragraphs explaining how Play App Signing works and how it's being enforced for new app bundles. The Huawei app repository has a similar approach to Play Store, and to my knowledge Amazon app repository has always been doing this (and even more nasty stuff: https://developer.amazon.com/docs/app-submission/understanding-submission.html#code_wrapper https://developer.amazon.com/docs/app-submission/understandi...).
lucb1e 5y ago
> [in] a third-party Play Store client called Aurora Store [...] I’d recommend against using the shared “anonymous” accounts feature: you should make your own throwaway account with minimal information. Why is that? I've been using the anonymous accounts because I figured sharing an account gives a lot less info to google, and we're downloading the apks directly from Google servers in the end. Is there something I should know?
- 0xdeadb00f 5y ago
  The anonymous account is picked from a pool of real accounts. The username/passwords are hardcoded into the app I'm pretty sure? So basically the aurora devs can login to this account and see the crap everyone's been downlidng (Id assume?)
upofadown 5y ago
The article links to "The PGP Problem" in an attempt to suggest that GPG signatures are bad somehow. Here are my comments on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp The article also claims that Debian has moved away from GPG signatures. This is not true. This all seems like a pointless distraction from the point that article is attempting to make...
- Wonderfall 5y ago
  There is literally a link in the article that takes you to the Debian website: https://wiki.debian.org/Teams/Apt/Spec/AptSign https://wiki.debian.org/Teams/Apt/Spec/AptSign I might rephrase that since they didn't technically moved away from OpenGPG (yet). It was a proposal at the time.
  - Wonderfall 5y ago
    Sorry, of course meant GPG, OpenPGP being the standard on which GPG is based on.
- southerntofu 5y ago
  Thanks for this article, it makes very good points. In particular, about the UX of GPG, i've found Sequoia to be a very good alternative: https://sequoia-pgp.org/ https://sequoia-pgp.org/
selfhoster11 5y ago
1) In the FOSS culture, there are higher standards around keeping devices functioning for longer, compared to commercial ecosystems. Enforcing a higher target SDK version improves "security" (whatever threat model that's supposed to protect me against), at the cost of turning more old Android phones into e-waste. Even Android 4 phones are still usable if permanently plugged in (to counteract battery degradation), and their hardware specs are still perfectly capable of functioning as a 720p YouTube machine, an internet radio, or whatever else comes to mind. 2) One person's overly broad API permissions are another person's gateway to programming an awesomely powerful application. Having my storage API taken away for an entire Android release because "hurr durr, security, we'll fix it in the next sprint" and not being able to use a file manager other than the meager thing I had included with my OS showed me how true that is.

40 points by ysnp 5y ago

Friday_ 5y ago

"There's no such thing as a system being secure, only being secure against a particular adversary."

jmnicolas 5y ago
My adversary is Big tech trying to control what I see, buy, experience, even think. I started to Tweet about a week ago. Most of my tweets get no traction, but if I speak about Ukraine suddenly I get a lot of views. To me it's the proof that Tweeter is controlling what we're thinking about.
- ChrisClark 5y ago
  Yeah, it's not like there is any major news about the Ukraine right now that millions of people are searching for. ;)
  - jmnicolas 5y ago
    Are they searching for it or Tweeter is force feeding it to them?
    - southerntofu 5y ago
      For sure more people (and bots) are searching for it. It's also quite possible some people following you (or the people who retweet you) are more interested about this hot topic: you could probably write a dozen tweet about monads and not get any interest, then post a single tweet about Julian Assange or Kim Kardashian and suddenly feel like the entire planet is talking to you. It's quite possible the Twitter algorithms are being nasty (i'm personally strongly against AI deciding what to show and how to order it in a timeline), but it's definitely not the only factor at play.

_joel 5y ago

Given the amount of malware in the play store, I'm not sure about this...

GuB-42 5y ago
It is addressed in the article. The point is that F-Droid weakens Android's security model, in other words, F-Droid requires more trust on your part. I think it is reasonable to trust the somewhat niche open source community more than the most popular and therefore the most attacked app store. You may also not want to feed Google, but it doesn't change the fact that F-Droid is technically less secure. The article's debatable suggestion is to get your favorite open source apps you trust from the Play Store to get the best of both worlds. The article is interesting because most of the points are actually fixable by F-Droid. So it is good to see from a "how to improve F-Droid" angle than "F-Droid sucks".
- onli 5y ago
  But it's irrelevant trust. Stuff about signatures and specific practices. What makes F-Droid more secure are the kind of apps that are in it, that the apps are FOSS alone makes it less likely for spyware to be added to them. Sure it can still happen and then F-Droid's security practices become relevant. But each time you install an app, there is more trust you can give to an app in F-Droid, than the basically zero trust you can give to proprietary app in the play store. The article is completely baffling in not really covering that. "strong security and privacy guarantees" mean jack shit when the game from the play store starts leaking all data it can grab or adds bank phishing - and it will have a bunch of permissions anyway, it legitimately needs them to function.

lucb1e 5y ago

> [devs] have to maintain a slightly different version of their codebase that should comply with F-Droid’s requirements Perhaps that's because I've got half a foot in the foss community and you don't hear a lot of "fml why is f-droid so strict about not using secret code", but to me it seems much more often that people complain about Google's policies than about F-Droid's. Especially since F-Droid's > “quality control” offers close to no guarantees because there are no restrictions on things that just work with root, donation links for open source open geo data contribution platforms[1], roll your own payment scheme without giving anyone a cut, put ads in it if you like... ... and yet I have no qualms letting my grandma browse around f-droid but am terrified of what bank phish she might be shown in an ad after roaming the google store. Technically the author is correct here, of course, but in practice this turns out to be a total non-issue. The rules are also not set in stone if it were to become one suddenly. --- (edited to add) > Their client also lacks TLS certificate pinning As does every web browser, but somehow banking on websites seems to very rarely be intercepted? I don't get the fuss about this and I work in the security industry. We recommend the most secure solutions, but sometimes there are trade-offs here: - Historically it has been recommended to turn off autocomplete in browsers <input> fields. I think we all agree on that one. - Historically it has been recommended to turn off backups in Android because, gee, someone could make a backup of your app data and what if that's an attacker somehow! An auth token might get out! Nobody cares that this makes it physically impossible to backup your data at all anymore on Android (Apple is doing very well on that front, I am very much impressed there even if it's not enough to make me buy into Apple by a long shot). This is one of the reasons I root my device and make fairly extensive use of it. - These days it's being recommended to use cert pinning which is a huge pain in the arms for anyone wanting to toy around with what the app does. Now in this case it's open source anyway, but think of, uh, yeah how about what the article mentions: "unlike Play Store which does that for all connections to Google". Wouldn't it be nice if you could actually see what this app sends to Google about you? Previously you'd add a cert to your OS and you'd be good to go. Now you have to modify the compiled application: a steep learning curve for anyone not working with app pentesting on a regular basis. For a high-security app like your banking app, alright, but for most other things I (as a tech nerd, clearly, I'm not an average user) think it's more harmful than beneficial. > their website has (for some reason) always been hosting an outdated APK of F-Droid, and this is still the case today Part of this sentence is a link to the forum. If you actually click that link, the "for some reason" becomes perfectly clear: f-droid-the-apk releases are shipped whenever it is ready, there is no beta channel in that sense. Whatever is on the homepage should work for everyone with any setup, and from there you can try to upgrade. If that fails, no biggie, you can just use the older version that works. Is what the forum says. (Not that I ever had a broken f-droid version myself, so not sure how important this really is.) > F-Droid is not the only way to get and support open-source apps. [...] Most of the time, releases are available on GitHub, which is great since each GitHub releases page has an Atom feed. Hah, the author just spent ~2800 words criticizing the liberal inclusion policy, missing api target enforcement, outdated (now slightly misleading) permission listings, lagging signature scheme update, and then concludes with "just download the apk from github because it has an Atom feed"! If only f-droid knew that this was the requirement for an endorsement by OP :D (jk) No really, use f-droid instead of github please or make sure you know how to check pgp signatures and have a chain of trust to the developer somehow. Or trust microsoft/github blindly, that's okay too (many of your apps come from there indirectly anyhow, if I'm being fair). But as blanket advice for a source of apps? That's... interesting in this context. > > Should I really care? > If security (and privacy, as they overlap) matters to you [then yes] It depends.... how much does security matter to you? Is this to the exclusion of all other values? It's a bit black-and-white. But then, yeah, as others said, the author works on their own security-oriented Android flavor (which is very good work by the way!). [1] see "un-features" https://github.com/streetcomplete/StreetComplete/releases/tag/v40.1 https://github.com/streetcomplete/StreetComplete/releases/ta... Edit: was this marked as off-topic or why is it stuck to the bottom despite upvotes? Usually neutral comments float somewhere around 2/3rds of the page, this comment is not neutral but upvoted and is at rock bottom.

dTal 5y ago

>The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You’re now adding another party you’ll have to trust since you still have to trust the developer anyway This is fallacious for several reason. Firstly, no I do not "have to trust the developer anyway" - I can always not install the app. I'm not starting with an app, adding my trust of the developer, and adding my trust of F-Droid - I am starting with F-Droid, and only installing apps which F-Droid trusts, because F-Droid's criteria for accepting apps are far more stringent than Google Play's - more stringent even than I could feasibly audit myself. Secondly, trust is not binary. Maybe I trust the developer enough to run their published source code, but not quite enough to run their precompiled binary that they might have slipped some tracking library into. Indeed this is very common and F-Droid strips a lot of such libraries. So even if we take it as a given that I am definitely going to install an app, and my only choice is between installing it from Google Play or from F-Droid, F-Droid is still superior because the builds on F-Droid are built from public source, and I am much more sure that F-Droid themselves won't slip malware into the builds because they have a track record of not doing that. Thirdly, Android's default app store, Google Play, also trusts a third party by default - Google, who insist on running a tracking rootkit on your computer, which is so much more egregiously invasive than trusting any one app that it renders any comparison with F-Droid moot.

hlbjhblbljib 5y ago
Doesn't google do exactly the same thing with the app store anyway?
- david_allison 5y ago
  As of August 2021, new apps must use Android App Bundles. Older apps can still be distributed without providing the key to Google. [0] https://developer.android.com/guide/app-bundle https://developer.android.com/guide/app-bundle [1] https://developer.android.com/guide/app-bundle/faq#app-signing https://developer.android.com/guide/app-bundle/faq#app-signi...
- orthecreedence 5y ago
  Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great lengths to force distribution through their "safe" channels.

prophesi 5y ago

Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.

LukeShu 5y ago
I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.
- prophesi 5y ago
  After reading the article, I clicked the link to their Github and saw a @GrapheneOS tab in their contribution graph. But taking a second look, I see that they haven't contributed to any of their repos in quite some time.
  - LukeShu 5y ago
    Note that just filing an issue shows up on the contribution graph. Looking a little closer, AFAICT, they have only filed 2 GrapheneOS PRs ever: https://github.com/GrapheneOS/platform_packages_apps_Settings/pull/49 https://github.com/GrapheneOS/platform_packages_apps_Setting... and https://github.com/GrapheneOS/platform_packages_apps_SetupWizard/pull/9 https://github.com/GrapheneOS/platform_packages_apps_SetupWi...
deleted 5y ago
[deleted]
guilhas 5y ago
I was already under the impression that the GrapheneOS developer(s) were overworked, but still they insist in doing everything themselves because no other project is good enough I have been using for the past year, and the 'advanced' user experience is not great. Updates are forced to the latest version of android, does not seem safe, and definitely does not feel stable, less customization than other roms, a bit aggressive towards root I will probably go back to lineageos microg f-droid and some hardened configurations F-Droid is provides invaluable service for android, privacy, open-source, android developers. GrapheneOS seems like an exercise in craziness a bit to extreme for me

616c 5y ago

This is some lazy "threat modeling without a threat model" kind of stuff IMHO.

flexagoon 5y ago
The article is just a list of insecurities of F-Droid. In fact, it even mentions that you can still use F-Droid if it fits your threat model or for ideological reasons.

hlbjhblbljib 5y ago

> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.

lucb1e 5y ago
If you trust Microsoft/GitHub more than F-Droid, you could also grab it from there: https://github.com/termux/termux-app#github https://github.com/termux/termux-app#github (you'll have to take care of your own update mechanism though) Not that I'd recommend it personally, but f-droid isn't the only option. Kind of the beauty of open source :). So often apps (e.g. from the government for corona) are only available if you first agree to the Google TOS and privacy policy. Which, of course, most people already did anyway, but the point here is that you don't need to if there's just a build from the devs somewhere, or a build environment you can replicate without too much trouble.
selfhoster11 5y ago
Yup. Raising the target SDK means that more phones become ewaste, not because of their hardware becoming outdated, but because their software will never receive an update.
- rahimnathwani 5y ago
  Raising the minimum SDK level might do this. This is separate from the target SDK level.
  - kuschku 5y ago
    Raising the target SDK just turns a general computing device into a glorified webbrowser, because you lose access to the filesystem, the ability to run background daemons, and the ability to run compilers. These should be permissions, not disabled wholesale.
    - 5y ago

johnx5c 5y ago

F-Droid demands more trust but it is also infinitely more trustworthy than the Play store. It looks like things can be improved (a lot) and I hope it does. F-Droid provides an invaluable service to those who value privacy and open source with very few volunteers.

BeefWellington 5y ago
As others have pointed out, this isn't even true anymore. Google's Play Store model lines up with what F-Droid is doing (effectively), so it doesn't really demand more trust, just different trust.

kuschku 5y ago

Yes, you have to trust F-Droid to sign apps. But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymore, Google holds the keys instead. The security model already assumes a third party is signing the apps.

chasil 5y ago
What surprises me about this article is that not one word is spoken of other appstores. A lot of bragging takes place about Play, but is silent on Amazon's appstore or any of the Chinese alternatives.
- Wonderfall 5y ago
  Author here. You're wrong, as I spent several paragraphs explaining how Play App Signing works and how it's being enforced for new app bundles. The Huawei app repository has a similar approach to Play Store, and to my knowledge Amazon app repository has always been doing this (and even more nasty stuff: https://developer.amazon.com/docs/app-submission/understanding-submission.html#code_wrapper https://developer.amazon.com/docs/app-submission/understandi...).

lucb1e 5y ago

> [in] a third-party Play Store client called Aurora Store [...] I’d recommend against using the shared “anonymous” accounts feature: you should make your own throwaway account with minimal information. Why is that? I've been using the anonymous accounts because I figured sharing an account gives a lot less info to google, and we're downloading the apks directly from Google servers in the end. Is there something I should know?

0xdeadb00f 5y ago
The anonymous account is picked from a pool of real accounts. The username/passwords are hardcoded into the app I'm pretty sure? So basically the aurora devs can login to this account and see the crap everyone's been downlidng (Id assume?)

upofadown 5y ago

The article links to "The PGP Problem" in an attempt to suggest that GPG signatures are bad somehow. Here are my comments on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp The article also claims that Debian has moved away from GPG signatures. This is not true. This all seems like a pointless distraction from the point that article is attempting to make...

Wonderfall 5y ago
There is literally a link in the article that takes you to the Debian website: https://wiki.debian.org/Teams/Apt/Spec/AptSign https://wiki.debian.org/Teams/Apt/Spec/AptSign I might rephrase that since they didn't technically moved away from OpenGPG (yet). It was a proposal at the time.
- Wonderfall 5y ago
  Sorry, of course meant GPG, OpenPGP being the standard on which GPG is based on.
southerntofu 5y ago
Thanks for this article, it makes very good points. In particular, about the UX of GPG, i've found Sequoia to be a very good alternative: https://sequoia-pgp.org/ https://sequoia-pgp.org/

selfhoster11 5y ago

1) In the FOSS culture, there are higher standards around keeping devices functioning for longer, compared to commercial ecosystems. Enforcing a higher target SDK version improves "security" (whatever threat model that's supposed to protect me against), at the cost of turning more old Android phones into e-waste. Even Android 4 phones are still usable if permanently plugged in (to counteract battery degradation), and their hardware specs are still perfectly capable of functioning as a 720p YouTube machine, an internet radio, or whatever else comes to mind. 2) One person's overly broad API permissions are another person's gateway to programming an awesomely powerful application. Having my storage API taken away for an entire Android release because "hurr durr, security, we'll fix it in the next sprint" and not being able to use a file manager other than the meager thing I had included with my OS showed me how true that is.